ZynorRAT
ZynorRAT is a Go-based remote access trojan (RAT) identified by Sysdig that targets Linux and Windows systems. It uses Telegram as its primary command-and-control channel, specifically a bot identified as @lraterrorsbot (also referred to as "lrat"). Reported capabilities include directory listing (/fs_list), system enumeration (/metrics) including hostname, current user, and public IP via api.ipify.org, process listing (/proc_list), process termination (/proc_kill), file exfiltration (/fs_get) via Telegram sendDocument functionality, screenshot capture (/capture_display) using the github.com/kbinani/screenshot library, persistence on Linux through a systemd user service at ~/.config/systemd/user/system-audio-manager.service, and arbitrary shell command execution via bash -c when input does not match a hardcoded command. Sysdig observed attacker-bot interactions showing commands such as screenshot capture and shell commands being issued through Telegram. The malware was described as being in early development, with the Windows version appearing near-identical to the Linux version and still retaining Linux-based persistence logic. Supporting reporting states that samples were uploaded to VirusTotal beginning on 2025-07-08, with later samples showing reduced detection, suggesting active refinement for evasion. Sysdig assessed with high confidence that the malware is of Turkish origin based on Telegram chats, network logs, reverse engineering artifacts, and telemetry, and suggested it may be the work of a single developer, possibly using the name or nickname "halil." Distribution was linked to the file-sharing service Dosya.co, and testing activity was observed on cloud instances and development systems. A published Linux sample was an ELF 64-bit x86-64 Go binary with SHA256 bceccc566fe3ae3675f7e20100f979eaf2053d9a4f3a3619a550a496a4268ef5.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Discovery
4 techniques
Discovery
Once executed, the malware extensively profiles the compromised host
Collection
2 techniques
Collection
Command and Control
2 techniques
Command and Control
IOCs tracked for this family
64 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Go-based RAT capable of targeting Windows and Linux systems (per excerpt).
A remote access trojan (RAT) written in Go, targeting Linux and Windows, with custom C2 capabilities and active development focused on detection evasion.
Go-based remote access trojan capable of running on Linux and Windows, providing persistent access to attackers.
A Go-based remote access trojan targeting Windows and Linux. It uses Telegram as C2 and supports file exfiltration, system enumeration, screenshot capture, arbitrary command execution, process listing and killing, and persistence via systemd services.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.